Hazard Analysis for a Liquid Propane Pipeline
Transcript of Hazard Analysis for a Liquid Propane Pipeline
Hazard Analysis for a Liquid Propane Pipeline R. Grollier Baron, R. Lombre, and Y. Rochina
ABSTRACT
European processing industries are doing more and more research on safety for installations presenting a great danger to the vicinity. Some of this research has been made mandatory by the so-called "Post Seveso" directive published by the European community. A study of this sort was carried out for a pipeline carrying liquefied propane from a refinery to two consumer plants about 200 km away. An underground storage facility is situated on the itinerary. The aim of the study is to determine the hazards that the pipeline constitutes for its environment, that is, the probability and gravity of an eventual accident. The procedure followed is now entirely standard for this type of study: (a) def inition of the system and its environment, (bl data gathering, (c) identification of the hazards and selection of the major hazards, and (d) analysis of the major hazards, including their probability and gravity.
The procedure for the study described in this paper is as follows: (a) definition of the system and its environment, (b) data gathering, (c) identification of the hazards and selection of the major hazards, and (d) analysis of the major hazards, including their probability and gravity.
DEFINING THE SYSTEM AND ITS ENVIRONMENT AND DATA GATHERING
The definition of the system naturally includes the description of the pipeline itself with details such as cutoff valves, pig traps, under-river passages, under-bridge passages, and so forth, and the system of remote monitoring and remote control. But it also includes its operation, maintenance, and monitoring, and the procedures in case of breakdown or accident.
The description of the environment is important because it may change and its composition at the moment of the study must be noted. This description of the environment includes determination of
• Thickly settled areas near the pipeline and the density of construction in the vicinity by the use of maps:
• Communication lines and roads, with an indication of the traffic:
• Sensitive points such as hospitals, schools, hospices and homes for the aged, shopping centers, camping grounds, and vulnerable industrial installations;
• Installations liable respect to the pipeline, crashes); and
to be aggressive with such as airports (plane
• Natural hazards such as flooding, quakes, and land slips.
earth-
141
To these must be added the relations between the operating company and third parties (administrations, riparian enterprises, etc.), mainly to prevent earth-moving operations from being undertaken in the vicinity of the pipeline without proper precautions.
IDENTIFICATION OF HAZARDS AND SELECTION OF MAJOR HAZARDS
The causes of accidents are usually multiple and generally involve the . simultaneous failure of components, each having only 1 imi ted consequences. The reliability of the syitem is thus essential for its safety.
By combining different methods, the possible failures of components or of operations (human failure) have been examined. The methods used were
• Check lists, • Failure Mode and Effect Analysis (FMEA) , and • Hazard and Operability Study (HAZOP).
Within the framework of this paper, it is not possible to list all the points examined. However, a few examples can be mentioned:
• Resistance to pressure surges, • Embr i ttlement of the metal by cooling as the
result of gas expansion, • Destruction as the result of flooding, • Reliability and sensitivity to storms of the
signaling and remote-control system, and • Formation of hydrates.
142
Among the hazards singled out, mention can be made of the following:
• Loss of inside fastenings, for example, by a valve, in which the loose parts prevent another valve from closing completely i hence the importance of using only valves that are suitable from this standpoint is stressed.
• Occurrence of a small leak in the section of the pipeline enclosed in the housing of a bridge crossing a river. There is danger of explosion in a confined lengthwise environment, which could cause the destruction of the bridge. It is easy to eliminate this hazard by filling the cavity with a light product to decrease the volume of air.
• Need for a strict procedure with a checklist and redundancy in monitoring for interventions on the pipeline during operation (stopple process for installing a shunt or for making a cutoff without emptying the pipeline).
• Danger of bursting in the overhead sections (pig traps) from the difference in thermal expansion between liquid propane and the metal envelope.
• Danger of movement of beacons.
To improve reliability, it was recommended that procedures be overhauled so as to help operators face up to failures of the system better while requiring that these procedures be scrupulously respected.
One of the obvious hazards is aggression by earth-moving equipment. Tests have shown that only equipment with a power of more than 120 hp can seriously damage a pipeline made of seamless drawn pipes designed for a service pressure of 60 bar and individually retested. Transportation of equipment having a power of more than 120 hp requires a special permit because of its dimensions, and so the operator of the pipeline can be warned of any work planned for such equipment in the vicinity of the pipeline so that such work can be monitored.
Other than the previously mentioned specific case of a small leak in a confined enclosure in a bridge structure and of the danger of bursting from a difference in expansion in pig traps, no other major hazard was found other t han the obvious one of a large opening in the pipeline. However, this thorough study served to emphasize the aspects to be improved from the standpoint of prevention (e.g., better monitoring of stopple operations) and particularly to improve the reliability of material and human means that must be implemented when the system deteriorates. In this way, a check was also made to see that considGration was given to dangerous situa-tions that are not obvious a priori (in the limitation of the knowledge of the team in charge of work).
ANALYSIS OF MAJOR HAZARDS
As just stated, the only major hazard to be taken into consideration is the one linked to a rupture or large leak that could turn into a flammable cloud of gas, leading to an explosion or the formation of a fireball. An explosion in a confined space in a bridge can easily be prevented by filling up the space, thus avoiding any major hazard. Bursting from a difference in expansion is reduced to a hazard of a large leak. This hazard was analyzed by way of its two components: probability of occurrence and seriousness of its consequences.
TRB State-of-the-Art Report 3
Probability of a Large Leak
The fault-tree method was used for this study. An examination of studies of accidents occurring to gas pipelines in the United States, published by the National Transportation Safety Board, showed that the causes of primary failure had not been overlooked. Then the probabilities of primary events occurring in the fault tree had to be quantified, for which statistics concerning important accidents occurring in a pipeline network having a known length were necessary. These data were provided by the annual reports of the Oil Companies' European Organisation for Environmental and Health Protection (CONCAWE), established in 1963 Chl. A statistical report is published annually on accidents and incidents occurring to the on-shore oil pipelines operated by the Western European petroleum industry. These incidents are classified into five major categories based on their origin as well as the total length of the pipeline in service: mechanical failures, operational errors, corrosion, material causes, and aggressions by third parties.
These data were confirmed by other publications and confidential information was obtained for various networks. In this way, a probability of about lo-• per kilometer and per year was obtained. Statistical analyses of the accidents studied enabled the relative values of the probability of each cause to be determined.
It should be pointed out that CONCAWE' s statistics have to do with pipelines carrying liquid hydrocarbons (crude oils and distillates) and not liquefied gas (Figure 1). Therefore, this fault tree had to be adapted for failures in the case of liquefied gas (Figure 2). This adaptation took into account the following:
• Because propane is not corrosive, only external corrosions are considered, and a probability of 1. 6 x 10- • per kilometer per pipeline per year was taken instead of 3. 2 x 10-' (in oil pipelines there is appreciable internal corrosion linked to the presence of water, salt, and sulfur compounds).
• The pipeline is made of seamless drawn pipes that have been individually tested for a service pressure of 60 bar. These pipes have no lengthwise or spiral seam like the ones used for oil. Likewise, in thickly settled areas, the transverse tie-in welds of the pipes are entirely X-rayed. The probability that the cause was mechanical properties of insufficient origin was reduced by a factor of 10 (0.2 x lo-• instead of 2 x 10-').
• For internal mechanical stresses, a negligible probability was assumed, considering that the maximum pressures caused by pumps, compressors, or other machinery linl<ed to the pipeline or pnssibly being accidentally linked to it are much less than those that it can normally withstand. The same is true for pressure surges.
• Nevertheless the probabilities linked to stresses transmitted by the ground, impacts, and so on, despite the mechanical properties of the pipeline, were integrally maintained.
Under such conditions, a leak probability of 5 .16 x 10-' per kilometer per year was reached. In the light of the previous discussion, this value can be considered too high, and a probability of only 5 x lo-• was retained.
To better analyze the hazard and to take the environmental diversity of the pipeline into consideration, 2-km sections were taken from pipelines in open country and in thickly settled areas. To spot the most important hazard, it was assumed that rup-
SlrtHel treOIU than mean pipe
1tren9lh
{+\3.83 10 ....
Eaternol lnttrnol
mechonlcol mechanical
COllH ca11H
3.36 10-• 0 .47 10-.•(+1
I I
Impact Overpru1ut1 jr =o
Direct 1tre11
2.52 10-•-r.\
I I I
l111pact incl11dl119 Er.platlon near lntunal Cr111hin9 llibratlon
olrPlane pip•
2 . 28 10""" 0.24 10 ..... ..o 0.18 10-•
I
Underwattr
i) work Eaplo•ion
I , •o 0 .08 10-•
Accident near Public work So_llota9e 11ncovertcl pi P• uploaion
0.11 10-• 0.08 10-• •o ~ I . I
Heat •hocll. Embrilllemtnl
... 0 CIQ
FIGURE 1 Simplified quantified fault tree applied to a petroleum product pipeline.
Preaenee of
hole or tear
7 .2 10-•
6
0 .47 10-• . Strtll tran1milled
by the 9ro11nd
0 . 84 10-·~
l
Impact tran1milltd by lhl 9round
0 .25 10-•
I
Earthquake
0.1 10-•
I
Defective ltn9thwiH weld
l
Corro1ion
3 .22 10-•
Mechonical 1tren9lh
1111 than nor"'al
5.19 10-•
I
Creation al a fault or
land 1lippo91 +l 0.41 10-•
I I
Loss ol lnsulticienl ari9lnol mechanical prop.mrly mechanical properly
3 .32 10-• I A .. 9110"""
I
Otltelivt tie- in weld Mattrlal
I-" .. w
Str ..... treater tllan mean PllMI'
1trengtll
{+\ 3.36 10 ....
• Eat1irnol
mecllonlcol COUH
).)6 10-•
I
Impact
jl~ :=:o
~
Direct 1trH1
2.~2 10-• I+\ • I
l111poct includlnt Eaploeion near I Cr111llin9 airplane pip•
2 . 28 10-4 0 .24 10-4 QI 0
I
Underwater
11) work
I ,•o
Accident ntar Pulllic work Sollo!Ot• uncovered pipe eaploalon
0.1. IO_. 0 .08 10-• •O
I
H9Qt llloCIL
20
FIGURE 2 New simplified fault tree applied to a propane pipeline.
I
Internal mecllonlcol
COUH
(+'\ :::o I
OverpreHure
-o
I
I lntt1nal
Villration
0.18 10-•
E•plo•ion
0 .08 10-•
~ I
Embrittlement
-- -GIQ
Pre11nc• of
llol• or teor
6.16 10-•
6
StreH tranemill•d
llr th• eround
0.4 10-•G\
I
Impact transmitted llr the 9round
O. Z!I 10-•
1
Eorthquoke
0 . 1 10-•
I
Detective len9tllwi11 ••Id
"'0 1
Corrosion
1.6 10-•
Mecllonical 1tren9tll
l•H tllan nor mo I
1.B 10_.
I
Creation of a foult or
land •Ii ppo9e +
0 .41 10-•
r l
Lou of Insufficient ori9lnal mtchanicol propartr 111tchanlcal propertr
1.6 10"'
I A 0.2111"' I
Detective tie-in weld Material
,..... ... ...
Special Hazard Situations
tures could cause a flow rate equal to the full cross section of the pipe. This type of rupture represents 14 percent of the accidental gaps (~) • The probability of such a rupture in a 2-km section is thus 2 x 5 x 0.14 x lo-•= 1.4 x lo-• per year.
This value can be decreased if the pipeline benefits from reinforced land and aerial monitoring as compared with that of oil pipelines or as the result of the presence of other pipelines in the immediate vicinity that have their own monitoring in some sectors. The probability of the impact clause linked mainly to aggression by earth-moving equipment can be considered to be proportional to the monitoring time.
r.onseguences of a Large Leak
A rupture in a pipeline causes extensive leakage of propane. Depending on whether it is ignited immediately or later on, the greatest consequences will be either the effects of radiation or of overpressure caused by explosion.
Effects of Radiation
Damage linked to the heat flow depends on its intensity, time of exposure, and the nature of the receiver. For example, for an exposure of 10 sec, damage to human skin is as follows:
• 6 kW m" 2 for pain, • 12 kW m" 2 for first-degree burns (red skin), • 25 kW m·• for second-degree burns (blistering)
and 38 kW m· 2 for third-degree burns (destruction of
the dermis).
Depending on the type of combustion (with or without the formation of soot), the radiance of hydrocarbon fires is about 30 kW m· 2
, but it can theoretically be as high as 100 kW m· 2 • If 90 kW m· 2 is taken as the increase, with a flame 25 m high by 10 m long, it can be seen that the radiation is 25 kW m· 2 at 15 m and 10 kW m· 2 at 25 m from the pipeline.
Effects of an Explosion
Usually the propane cloud emitted does not ignite immediately. There
from a rupture is then a de-
TABLE 1 Damage Associated with an Overpressure Wave
145
flagration in which the increasing flame velocity causes a destructive overpressure wave. The effect of the explosion naturally depends on the time that elapses between the creation of the rupture and the appearance of a source of ignition at a suitable spot.
For lack of a statistical basis for determining the frequency of nonignition and the distribution of ignition times, the following assumptions were made for the latter:
• Near roads with heavy traffic or in thickly settled areas, 15 sec;
• In the vicinity of a secondary road or a thickly settled area, 30 sec; and
• When the pipeline is fairly far from individual houses, 60 sec.
These values are considered plausible orders of magnitude and variable in large proportions depending on the time of day, the season, and so on. Because these calculations use multiple increase assumptions to describe the sequence of phenomena, to remain homogeneous with a probabilistic analysis it is important not to multiply the increase assumptions and to take those that are the most probable, even if this means increasing the final result for the sake of security. In any case, the increasing of more than one assumption must be avoided.
In this case, to appraise the effect of the explosion, the equivalent of trinitrotoluene (TNT) was used with the assumption that 1 kg of hydrocarbons emitted creates, outside of the close proximity, overpressure effects equivalent to 1 kg of TNT. This equivalence stems from an analysis of some 100 accidents and covers 97 percent of the cases (3_).
Calculating the amount of propane issuing from a rupture is delicate because of the multiple phenomena involved, particularly the thermodynamic ones, especially during the first 30 sec. The situation then moves toward a relatively steady state. The model proposed by Duiser (3) was used, taking into consideration the location - of the rupture and the effects of the relief on the hydrostatic pressure.
The study showed that at the end of 4 min as much propane was entering the cloud defined by the flammability limits as was leaving it. A time of 4 min was also taken into consideration to obtain an idea of the maximum conceivable accident (without any probability concept). The amount of gas emitted that was calculated in this way was associated with the concept of TNT equivalence defined earlier. The cen-
Incident' Overpressure (bar)
Damage to Persons
Mortal lesions in more than 50 percent of cases by shock wave, fragments, structural collapse
Serious lesions, perhaps mortal, by fragments or debris, or projection of persons onto angular surfaces by shock wave; possibility of eardrum lesion by shock wave
Lesions by fragments or debris or projection of persons onto angular surfaces by shock wave; possibility of temporary deafness by shock wave
Possibility of lesion by fragments or debris or broken glass
Very slight possibilities of slight lesions by fragments or debris or broken glass
Reduced Distance (m/kg)
8
15
22
44
French Pyrotechnical Regulation
0.6
0.3
0_1
0_05
TM5-1300
0.40
0.18
0.08
0.05
0.03
Damage to Standard Constructions not Designed to Resist Effects of Aerial Pressure Wave
Very extensive damage (shell or buildings) approaching total destruction
Serious damage (shell or buildings) for which the cost of repairs is 3 percent of the cost when new
Medium damage (roof, interior) for which the cost of repairs is I 0 percent of the cost when new
Light damage (doors, windows, etc.)
Very light damage (broken windows when of large size)
aThe overpressure differences that can be seen between the regulation and TMS-1300 (4) can be explained by the Fact that the values of the regulation are the envelope of the values that can be found in the Jiterature.
146 TRB State-of-the~Art Report 3
6P (bar) 'T'NT CUil.VE I TM 5 -1300 I 6.Plbar)= f(RI \ml) 6p(Pa)
05
4
0,16 O,i4
Surpression 1,,c.IUDou•
I
I\ \ \ \
\ I
! I I I
1
I -\ I
\ I '\
f\ ; I -i\
0.1 9 8 7 6
5
I
I l ~ j I I I
1 o• • ' I ' I '-
" I \
' I
' I 4 ' ' ' ' '
' '
0,01 1c' 4 6 7 8 9 10 20 30 40 so 60 70
FIGURE 3 Open-field characteristics for a TNT explosion at ground level.
ter of the explosion was considered to be the point reached by the cloud in the assumed time and the speed was assumed to be that of the most frequent wind (here 2.5 m/sec).
An 0. 15-bar overpressure er i ter ion was assumed, halfway between overpressures creating light damage (doors, windows, etc.) and those creating medium namage (roofs, partitions) [Table l <!>]. Figure 3 can then be used to determine the distance from the center of the explosion and to define a strip in which the overpressure could exceed 0.15 bar.
It should be noted that various increase assumptions were used, and at the same time the uncertainties are great.
CONCLUSION
This study has improved the knowledge of the system environment. The risk identification revealed those points for which prevention must be improved as well as reliability when the system becomes defective.
The study permits the determination that no hazardous situations within the limits of actual knowledge are forgotten. The risk analysis in terms of probability and gravity is a good support of the reflexion and shows the more probable assumption.
REFERENCES
1. Annual Report. Oil Companies' European Organisation for Environmental and Health Protection (CONCAWE), The Hague, Netherlands.
2. M. Lannoy. Bulletin de la Direction des Etudes et Recherches E.D.F., No. 4, Series A, 19841 thesis, University of Poitiers, France, May 1983.
3. Duiser Industrial Chemical Enqineerinq Symposium, Series 86, April 1974, p. 163.
4. Structures to Resist the Effects of Accidental Explosions. Technical Manual TM5-1300/NAFVACP397/AFTM 88-22. U.S. Army, Navy, and Air Force, June 1969.